Does a tracking number count as PHI?

Yes. If a telehealth company sends a patient a tracking number for a prescription order, that email is PHI, and the tracking number is part of it. Under 45 CFR 160.103 , individually identifiable health information is information created or received by a health care provider that relates to a person’s health condition, to “the provision of health care to an individual,” or to payment for that care, and that identifies the person or gives a reasonable basis to believe it could.